Rogue bots can bypass restrictions, invoke tools and affect critical operations; organisations need to tighten identity, permission, monitoring and testing controls
Recent investigations of rogue AI agents have found that the autonomous bots had used more than 10 previously undisclosed websites for unauthorised communication.
The reported global vigilance activity illustrates a security concern: autonomous systems may find unexpected pathways around restrictions and pursue objectives beyond those anticipated by their developers.
Such behavior raises questions of oversight, accountability and control. For organisations deploying agents with access to enterprise systems, the priority is to move beyond experimental deployments and establish operational security controls. These systems are no longer simple chatbots or assistants. They can invoke tools, execute workflows, access data and, in some environments, interact with connected devices and business-critical systems.
Joelle Booi, Country Lead for Singapore, Zebra Technologies
Consolidating cybersecurity priorities
Traditional AI security concerns — prompt injection, data leakage and model vulnerabilities — remain important. Security teams also need to address a broader challenge: governing autonomous agents that can access tools, execute workflows, interact with connected systems and influence business outcomes with limited human oversight.
An agent deployed in one business unit may interact with cloud platforms, regional databases, third-party services and physical infrastructure elsewhere. Security controls therefore need to cover the agent, its credentials, the tools it can invoke and the systems those tools can affect.
Strategies to keep agents on reins
The shift is from securing AI models alone to securing AI agents as software entities with their own identities, permissions and operational footprints:
1. Manage agent identities and access
Autonomous agents should not receive broad access simply because they are connected to an application. Each agent should have a verifiable identity, scoped access rights and defined operating boundaries. Permissions should be reviewed across the agent lifecycle, and activity should be logged for audit.
For example, an inventory-optimisation agent should not automatically receive access to customer payment systems. A route-planning agent should not be able to modify warehouse-management configurations without authorisation.
Least privilege limits each agent to the access required for its intended task. Without such controls, an agent can become a highly privileged non-human identity with access to sensitive systems and data.
2. Control MCP and tool access
The Model Context Protocol (MCP) is increasingly used to connect AI agents with enterprise tools, databases, applications and external services. That connectivity enables automation, but it also expands the attack surface.
Organisations should not assume an agent will remain within intended communication boundaries merely because restrictions appear in its instructions. Controls must be enforced through permissions, system architecture and monitoring.
Security teams should govern MCP servers and tool integrations by:
- Validating trusted MCP endpoints
- Maintaining allowlists of approved tools
- Inspecting contextual information passed to models
- Monitoring tool usage and logging requests and outcomes
- Restricting write, administrative and irreversible actions
In practice, this may mean limiting an agent’s access to pricing engines, loyalty systems or inventory platforms; or controlling access to transportation-management systems, warehouse-automation platforms, carrier networks and shipment-tracking services.
A compromised tool connection can create risk beyond a single system. It may expose suppliers, carriers, warehouse operators, retailers and customers to downstream disruption.
3. Secure all runtime operations
Security cannot stop at deployment. Agents must be monitored continuously throughout their operational lifecycle.
Runtime controls should include policy enforcement, behavioral monitoring, approval checkpoints for high-risk actions, anomaly detection and emergency kill switches. These controls help identify and contain risky behaviour before it affects business operations.
For example, a retail agent that suddenly attempts to modify thousands of product prices should trigger investigation. A logistics agent that begins rerouting large volumes of shipments or changing delivery schedules outside established policy should be flagged immediately.
Continuous visibility matters because agents can deviate from expected behaviour due to changing inputs, evolving objectives or malicious manipulation.
4. Extend security to connected devices
Agentic AI may interact with physical infrastructure and frontline systems, including point-of-sale devices, handheld scanners, kiosks, warehouse scanners, robotics, vehicle telematics and industrial IoT sensors.
A compromised endpoint can influence the data an agent relies on, and therefore the actions it takes. Device trust, posture validation, endpoint security and continuous compliance monitoring should be integrated into an agentic AI security strategy.
5. Build security across every layer
Securing AI agents requires more than protecting the underlying model. Strong authentication, least-privilege access, token management, behavioral analytics and continuous monitoring should operate together as defence in depth.
Organisations should also test how agents behave across complete workflows. Traditional penetration testing alone may not capture risks arising from tool chaining, workflow manipulation or business-logic abuse.
Testing should cover threats including prompt injection, goal hijacking, privilege escalation, tool abuse, workflow manipulation and business-logic attacks. The objective is to identify weaknesses in complete agent workflows before attackers do.
As AI agents gain access to corporate systems and operations, the central question is how to secure them both as software and as digital identities: with defined ownership, least-privilege access, controlled tool use, runtime monitoring and clear paths to intervention.
